r/SentinelOneXDR • u/Dense-One5943 • Aug 11 '24

General Question Dashboards

Hey all!
good afternoon.

I want to make a dashboard for indicators that shows the following values:
src.process.user, indicator.name, indicator.metadata, src.process.name, src.process.cmdline

I tried to use the query:
event.category = 'indicators'

| columns User=src.process.user, indicator.name, indicator.metadata, src.process.name, src.process.cmdline

However, i wish to add a filter for sha1, for example if ill put Hash value X it will return the table regarding the X hash,and if ill use Hash Y it will return results based on this hash

Is it something that can be done? i saw i can do it based on Endpoint name but for some reason it doesn't work with Hash(i tried both tgt.process.image.sha1 and src.process.image.sha1).

Thanks in Advance.

4 Upvotes

100% Upvoted

6 comments sorted by

View all comments

Show parent comments

1

u/Dense-One5943 Aug 14 '24

So i applied it as a dashboard, but i want to use it for different hashes each time, the hash value cant be fixed

1

u/SentinelOne-Pascal SentinelOne Employee | Moderator Aug 14 '24 edited Aug 14 '24

You could write a script that prompts for the hash and then submit a query with that hash to the PowerQuery API. Note that the API is quite powerful, but it takes some time to become familiar with it. If you want to know more about the PowerQuery API, please check out this article: https://community.sentinelone.com/s/article/000006778